Quiz Entry - updated: 2026.10.13
Which roles make up a product security organisation before launch, and what does each do?
Senior management decides and provides resources; the Chief Product Security Officer owns strategy and policy; product security officers support projects and assessments; architects define security architectures; analysts (often a PSIRT) handle vulnerabilities and disclosure; security champions spread know-how inside R&D.
* A small central team reaches every R&D team through security champions. *
| Role | Responsibilities |
|---|---|
| Senior management | Decide, communicate, prioritise, provide resources |
| Chief Product Security Officer | Accountable for product security; strategy, goals and policy; leads the security organisation |
| Product security officers / experts | Define policies and standards, conduct risk assessments, support audits, projects and issue handling |
| Product security architects | Define security architectures, support security design, conduct architecture reviews |
| Product security analysts (often the PSIRT, Product Security Incident Response Team) | Vulnerability and incident handling, vulnerability monitoring and threat intelligence, responsible disclosure, information sharing, customer security support, security testing |
| Security champions | Security-aware developers and architects inside R&D who spread know-how and lead security features |
Security champions scale the team. A small central group cannot review every commit, but one trained developer per team can catch most problems early.
Go deeper:
FIRST — PSIRT Services Framework — the services a PSIRT offers